engine: configure deferred authentication method

The default deferred_auth_method of password is deprecated as of
Icehouse, so although it is still the default, deployers are strongly
encouraged to move to using deferred_auth_method=trusts, which is
planned to become the default for Juno.

* It avoids storing user credentials in the heat database
* It removes the need to provide a password as well as a token on stack create
* It limits the actions the heat service user can perform on a users behalf.

This patch aims to:
* Set deferred_auth_method = trusts in /etc/heat/heat.conf for engine
* Specify the roles to be delegated to the heat service user
   (trusts_delegated_roles in heat.conf, defaults to heat_stack_owner
   which will be referred to in the following instructions. You may wish
   to modify this list of roles to suit your local RBAC policies)
* Create the role(s) in Keystone (optional and enabled by default).

Change-Id: I99eaf29473bc4e70017580b3b340c24093aa0619